Analysis
-
max time kernel
20s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09/01/2024, 12:10
General
-
Target
5e835ed7571a072287f49dd91fa964024c8807f617007b295c9a30c84fad01b7.exe
-
Size
274KB
-
MD5
8bf34515e846b12fccc9a0520d597ea2
-
SHA1
b285093dc2405fc07aba7127300171003efae760
-
SHA256
5e835ed7571a072287f49dd91fa964024c8807f617007b295c9a30c84fad01b7
-
SHA512
8a6c635fcc2eab74235044466517e913b0b217887a54866da63cc5a2f0a4ceae2b2640b02fbaa9e0428e8ad64aae0d87a2a182abf6aa1c5a3db94d09db66accc
-
SSDEEP
6144:HbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:HPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 7 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Windows directory 1 IoCs
-
Delays execution with timeout.exe 1 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e835ed7571a072287f49dd91fa964024c8807f617007b295c9a30c84fad01b7.exe"C:\Users\Admin\AppData\Local\Temp\5e835ed7571a072287f49dd91fa964024c8807f617007b295c9a30c84fad01b7.exe"1⤵
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\5e835ed7571a072287f49dd91fa964024c8807f617007b295c9a30c84fad01b7.exe"2⤵
-
-
C:\subst.exe"C:\subst.exe"1⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 11⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56adb17b51e414e9777e5772f5c87578c
SHA1337b5e906f5bd4bea5d69bdc17491d1a9337d8b7
SHA2561f0eecf94284ef614262a626d5ef641c8107dc4dce38a3ca5de6b86feaaca486
SHA5127cdc275525db57a9d378b49c16128d61e675a03d5ff69867ac2fcaa5529f99609899dae17b390bb1fce18728406795587c9b6adcc21ddbc5eb6108836715cc80
-
Filesize
1KB
MD5cf93404aebacdf7d1fbea37633947548
SHA1e7bb1e9ec983e316ab15e276a92df117dcf229ac
SHA25688c92be43e1fa93de8e36e46067503969ac55ac44e527ef708aae1ae938f0543
SHA512d9e71e5deb979f15904ab296e3287dc75de4e7fb13b4cf83b30719c5b7d505233c91835f46b53278612c4979f1911380aa94c86a4088043b1a92fe860d7b517c
-
Filesize
599B
MD5f96ecfa638c3aca693a31877ae91e99a
SHA14fedb6302d1a15550e7dfee93106387641e8238c
SHA2564ad36ed748113e264b363f70b889644a21b60149abd67bca3689a6fb7eb6edbe
SHA5122a6fba287020f7b42caa93552ab839ccd7bf980f8d89c39aff8a068be732ff276fd1ff0b0127bfb54ac52d8ea8e6566a12627b844db8d40ddc011ff1cb4e721e
-
Filesize
484B
MD50dbe6f5f517a3bbd5bf76929b7c78883
SHA1544c6b091853d78d975d6439227af4d0bbbe9507
SHA256340aa15babc4d9a2ada64afe82b56a0233f66b905a4fcac055eb73eaffc048e6
SHA512b52a42e6f466c80f65b652e5c34788a81c7bfb0409e3125b70f2bfe0995c1cbb04b6823637717fa9b3287070e314487138b9225aef4fef789314d75c1419f1f1
-
Filesize
344B
MD5d7e43b54962328d098b4997ca2e1d23f
SHA192286423962198715b437d5d9a3a1cf9e0b57ec3
SHA256caaa7628cf32c2c25757ee591e6f92448ec2c3eb507a889e05d35fe291da2345
SHA5123e1ee8035de9fda21e86652bd7c3d86de791725184996ac97c669dcffc5b3a69266c609d445446e9b9a4088ddaf8675e7ac7cf7e3a88927352642ff1d3cd0f6a
-
Filesize
344B
MD588d8874215341d81ddb4bca0a0bda807
SHA1822a7659dde2a48a6e702fb0a949d65fff5a7a07
SHA256cec0e7fb5ddf295faacf08a4c890216f9867f39de25a9102baec169396822a97
SHA512527f1fb8540a1fd701eb644940ec914fe333f062f509efa043c344dafad21d8fcd94105b1a1dec671199ae21b699d9a1786d4644aef6f543b8cba92dcb6df97f
-
Filesize
344B
MD5d744f23a10baf659b490698292c2821e
SHA1d9907e3672f215855f26aa8168e9ec530f811d96
SHA256cda4a7ce299bb883f47dd959984129b9d44291fdeb0faab6062a1061b043d536
SHA5124ab03b233f1345bfc7602716c4ae2eb1e27ba2c1e5e863f842f5e7715a16963be370e7e17f966208b4b52a1e548a4e91166dd5abe5c4188760edccead75ed0cb
-
Filesize
482B
MD5b830685a9c4bc07fa19363e979e264fa
SHA19f23ad507d47c3a3edaec8086f006ea82e024b5f
SHA256c23026e4ec259546c811a5406921442c6630b5f2257f8ac65e85c3589d163b95
SHA512381f1e9809c50da5b1c9d073f011fe49d90480290f21f1812b05ca0c04bf730b0b9d74280081876128d25dfa602de8a8b20f1931e3710b6e2f748c86f70eb3e5
-
Filesize
504B
MD58d95b29c12ca5fe7ee86d4d707198814
SHA17979d1e88fb8ab42e7fe15b08f34ffc793cea7f8
SHA2563a92589744bfbe32c13e756a3bfc919e5ac36fd7a910854b95808ccaaaad31dc
SHA5124a578d0e4d4e8bee8a8951619a32e6bd957eb516685c8939cae6d841ef2e55f4e73a4316f4afbafad275556a54abbc374fd1090675e5289892e4df6444cef882
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
63KB
MD59db8b9fb2f130326985e722833fc424c
SHA1b3490bbc79d03af8dcf74cbeae5b15e4d1edb199
SHA256515cd9290c9f85844e18522e9d9ac3f0262a58e769d991a4d18f72ec3c6fee61
SHA512bb012d792a86144a7d60926ad256c17817a9a6e2ee8813fe30282fe7ec7af914c0138dc8c4fccfceed88f56187497c64d501c4f34ea87b9d2182271e0ef1c903
-
Filesize
15KB
MD5210e823866af38dea6b1383286257d45
SHA1884722f79bb55c9aaf5d350ffa9212b608afd176
SHA2561044aa234ae106cd0f668c2eb65c79e0e6b2a980bf7e97abc546fc4a5730a283
SHA5127c87c1e05eb0308da559468a6c44116c715f33bd90c5a969927f2206d0cb4e48c7c8a7fa9a7854a39a10073f9219bd10976cc0c5008dd583c6a282e65b8c421b
-
Filesize
1024KB
-
Filesize
2.5MB
-
Filesize
12KB
-
Filesize
2.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
160KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
160KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
12KB
-
Filesize
2.7MB
-
Filesize
12KB
-
Filesize
2.7MB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB